General Questions

I am trying to monitor my bandwidth usage as my ISP has recently decided to 'fine' users who go over a new monthly limit on their DSL connection.

I am using mrtg to monitor monowall via snmp and mrtg Total Traffic Generator by Bjorn Patrick Swift to track my usage but I am a little confused by the numbers I am seeing. My modem is running in bridged mode with pppoe on monowall so I have the virtual ng0 interface which gets the public IP and the physical interface is vx0. The two show different numbers and I'm trying to confirm which is which.

I have an aiccu  ipv6 tunnel which terminates on a nat machine behind monowall, a 6in4 tunnel that that terminates on monowalls wan and then all the ipv4 traffic from the rest of my network. 

It seems that the 4in6 tunnel traffic does not register on the pppoe ng0 interface while the aiccu tunnel traffic does and that the pppoe traffic does register on the vx0 physical interface.

Would I be correct in concluding that the vx0 numbers would show ALL traffic coming in?

Thank you.

I don't have an answer for you about which interface or interfaces you should be looking at. Perhaps just watch them all for a while under known usage conditions and see what adds up to what.

Also, you might want to have a look at IOG. For your stated purpose it seems to be ideal. I have used it in the past for many years.

http://www.dynw.com/iog/

For bandwidth graphing I'm using WallWatcher with m0n0 that allows you to collect, view and analyze logs from a variety of routers. It's a great resource. Been using it for about 8 years. It's running on Windows 2003 Server and sends daily logs to DShield.

http://wallwatcher.com
http://dshield.org

I would go with the physical interface.
Anyhow all WAN packets must go through it.

Thanks for the replies.

I guess the consensus is that all traffic from my ISP will have to go through the physical WAN interface vx0 so that is what I will monitor.